1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["583"],{41844:function(e,n,s){s.r(n),s.d(n,{frontMatter:()=>r,toc:()=>t,default:()=>p,metadata:()=>c,assets:()=>a,contentTitle:()=>o});var c=JSON.parse('{"id":"network-policy/policy-rules/service-policy","title":"Use service rules in policy","description":"Use Kubernetes Service names in policy rules.","source":"@site/calico_versioned_docs/version-3.28/network-policy/policy-rules/service-policy.mdx","sourceDirName":"network-policy/policy-rules","slug":"/network-policy/policy-rules/service-policy","permalink":"/calico/3.28/network-policy/policy-rules/service-policy","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/network-policy/policy-rules/service-policy.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Use Kubernetes Service names in policy rules."},"sidebar":"calicoSidebar","previous":{"title":"Use namespace rules in policy","permalink":"/calico/3.28/network-policy/policy-rules/namespace-policy"},"next":{"title":"Use service accounts rules in policy","permalink":"/calico/3.28/network-policy/policy-rules/service-accounts"}}'),i=s(37937),l=s(17869);let r={description:"Use Kubernetes Service names in policy rules."},o="Use service rules in policy",a={},t=[{value:"Big picture",id:"big-picture",level:2},{value:"Value",id:"value",level:2},{value:"How to",id:"how-to",level:2},{value:"Allow access to the Kubernetes API for a specific namespace",id:"allow-access-to-the-kubernetes-api-for-a-specific-namespace",level:3},{value:"Allow access to Kubernetes DNS for the entire cluster",id:"allow-access-to-kubernetes-dns-for-the-entire-cluster",level:3},{value:"Allow access from a specified service",id:"allow-access-from-a-specified-service",level:2},{value:"Additional resources",id:"additional-resources",level:2}];function d(e){let n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,l.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"use-service-rules-in-policy",children:"Use service rules in policy"})}),"\n",(0,i.jsx)(n.h2,{id:"big-picture",children:"Big picture"}),"\n",(0,i.jsx)(n.p,{children:"Use Calico network policy to allow/deny traffic for Kubernetes services."}),"\n",(0,i.jsx)(n.h2,{id:"value",children:"Value"}),"\n",(0,i.jsx)(n.p,{children:"Using Calico network policy, you can leverage Kubernetes Service names to easily define access to Kubernetes services. Using service names in policy enables you to:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Allow or deny access to the Kubernetes API service."}),"\n",(0,i.jsx)(n.li,{children:"Reference port information already declared by the application, making it easier to keep policy up-to-date as application requirements change."}),"\n"]}),"\n",(0,i.jsx)(n.h2,{id:"how-to",children:"How to"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"#allow-access-to-the-kubernetes-api-for-a-specific-namespace",children:"Allow access to the Kubernetes API for a specific namespace"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"#allow-access-to-kubernetes-dns-for-the-entire-cluster",children:"Allow access to Kubernetes DNS for the entire cluster"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"#allow-access-from-a-specified-service",children:"Allow access from a specified service"})}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"allow-access-to-the-kubernetes-api-for-a-specific-namespace",children:"Allow access to the Kubernetes API for a specific namespace"}),"\n",(0,i.jsxs)(n.p,{children:["In the following example, egress traffic is allowed to the ",(0,i.jsx)(n.code,{children:"kubernetes"})," service in the ",(0,i.jsx)(n.code,{children:"default"})," namespace for all pods in the namespace ",(0,i.jsx)(n.code,{children:"my-app"}),". This service is the typical\naccess point for the Kubernetes API server."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: projectcalico.org/v3\nkind: NetworkPolicy\nmetadata:\n name: allow-api-access\n namespace: my-app\nspec:\n selector: all()\n egress:\n - action: Allow\n destination:\n services:\n name: kubernetes\n namespace: default\n"})}),"\n",(0,i.jsx)(n.p,{children:"Endpoint addresses and ports to allow will be automatically detected from the service."}),"\n",(0,i.jsx)(n.h3,{id:"allow-access-to-kubernetes-dns-for-the-entire-cluster",children:"Allow access to Kubernetes DNS for the entire cluster"}),"\n",(0,i.jsx)(n.p,{children:"In the following example, a GlobalNetworkPolicy is used to select all pods in the cluster to apply a rule which ensures\nall pods can access the Kubernetes DNS service."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: projectcalico.org/v3\nkind: GlobalNetworkPolicy\nmetadata:\n name: allow-kube-dns\nspec:\n selector: all()\n egress:\n - action: Allow\n destination:\n services:\n name: kube-dns\n namespace: kube-system\n"})}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"This policy also enacts a default-deny behavior for all pods, so make sure any other required application traffic is allowed by a policy."})}),"\n",(0,i.jsx)(n.h2,{id:"allow-access-from-a-specified-service",children:"Allow access from a specified service"}),"\n",(0,i.jsxs)(n.p,{children:["In the following example, ingress traffic is allowed from the ",(0,i.jsx)(n.code,{children:"frontend-service"})," service in the ",(0,i.jsx)(n.code,{children:"frontend"})," namespace for all pods in the namespace ",(0,i.jsx)(n.code,{children:"backend"}),".\nThis allows all pods that back the ",(0,i.jsx)(n.code,{children:"frontend-service"})," service to send traffic to all pods in the ",(0,i.jsx)(n.code,{children:"backend"})," namespace."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: projectcalico.org/v3\nkind: NetworkPolicy\nmetadata:\n name: allow-frontend-service-access\n namespace: backend\nspec:\n selector: all()\n ingress:\n - action: Allow\n source:\n services:\n name: frontend-service\n namespace: frontend\n"})}),"\n",(0,i.jsxs)(n.p,{children:["We can also further specify the ports that the ",(0,i.jsx)(n.code,{children:"frontend-service"})," service is allowed to access. The following example limits access from the ",(0,i.jsx)(n.code,{children:"frontend-service"}),"\nservice to port 80."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: projectcalico.org/v3\nkind: NetworkPolicy\nmetadata:\n name: allow-frontend-service-access\n namespace: backend\nspec:\n selector: all()\n ingress:\n - action: Allow\n protocol: TCP\n source:\n services:\n name: frontend-service\n namespace: frontend\n destination:\n ports: [80]\n"})}),"\n",(0,i.jsx)(n.h2,{id:"additional-resources",children:"Additional resources"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"/calico/3.28/reference/resources/networkpolicy",children:"Network policy"})}),"\n",(0,i.jsx)(n.li,{children:(0,i.jsx)(n.a,{href:"/calico/3.28/reference/resources/globalnetworkpolicy",children:"Global network policy"})}),"\n"]})]})}function p(e={}){let{wrapper:n}={...(0,l.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},17869:function(e,n,s){s.d(n,{R:()=>r,x:()=>o});var c=s(82645);let i={}
1,l=c.createContext(i);function r(e){let n=c.useContext(l);return c.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),c.createElement(l.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.